Add SSH-managed node registry with connection testing and reauth.

Register hosts under Containers/VMs/Docker with encrypted key storage, and require re-authentication for sensitive account changes.

service/internal/api/groups_handlers.go

@@ -158,10 +158,8 @@ func validateGroup(group settings.Group) error {
 		return errors.New("group.scope_name is required")
 	}
 
-	if len(group.Permissions) == 0 {
-		return errors.New("group.permissions must be non-empty")
-	}
-
+	// Empty permissions are allowed so a newly scoped node group can be
+	// created first and roles assigned later in Configuration → Groups.
 	for _, permission := range group.Permissions {
 		if strings.TrimSpace(permission) == "" {
 			return errors.New("permission strings must be non-empty")